Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

5.2. Using Identity Management for Authentication

Satellite 5 now offers authentication through an IdM or IPA server, which provides support for:
  • Kerberos authentication in the WebUI
  • Users do not need to be pre-created in Satellite database
  • The PAM authentication can be enabled for all users
  • User roles can be derived from user group membership in the external identity provider
  • System Groups administrators can be derived from user group membership in the external identity provider per Organization

Note

IPA authentication configuration only works with Satellite 5's Web UI. Client tools like rhn_register, rhnreg_ks, spacecmd, rhncfg-manager and the Satellite 5 API can not use IPA authentication.

5.2.1. Requirements
Copiar enlace

Satellite Authentication through IPA has the following requirements:
  • A configured Satellite Server. The following instructions will use the hostname satellite.example.com to denote the Satellite server.
  • A configured IPA/IdM Server on Red Hat Enterprise Linux 6 or 7. The following instructions will use the hostname ipa.example.com to denote the IPA server.
  • Installation of additional packages on the Satellite server. Use the following command to install these packages from the standard Red Hat Enterprise Linux 6 and 7 repositories: 
    [root@satellite ~]# yum install ipa-client ipa-admintools sssd sssd-dbus mod_auth_kerb mod_authnz_pam mod_lookup_identity mod_intercept_form_submit -y
    Copy to Clipboard Toggle word wrap
  • The latest version of the selinux-policy package to ensure the latest SELinux Booleans are added. You can update this package with the following command: 
    [root@satellite ~]# yum update selinux-policy -y
    Copy to Clipboard Toggle word wrap

5.2.2. Enrolling the Satellite Server
Copiar enlace

Enrol the Satellite server with the IPA server using the ipa-client-install command. This will step through the required configuration options to enrol the Satellite server. 
[root@satellite ~]# ipa-client-install
Provide the domain name of your IPA server (ex: example.com): example.com
Provide your IPA server name (ex: ipa.example.com): ipa.example.com
Hostname: satellite.example.com
Realm: EXAMPLE.COM
DNS Domain: example.com
IPA Server: ipa.example.com
BaseDN: dc=example,dc=com

Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin
Synchronizing time with KDC...
Password for admin@EXAMPLE.COM: *********
Copy to Clipboard Toggle word wrap
When complete, the Satellite server acts as an client using the IPA Server details.
The IPA server also requires a HTTP Service for the Satellite server. Authenticate the Satellite server against the IPA server with the admin user and run the ipa service-add command: 
[root@satellite ~]# kinit admin
[root@satellite ~]# ipa service-add HTTP/satellite.example.com
--------------------------------------------------
Added service "HTTP/satellite.example.com@EXAMPLE.COM"
--------------------------------------------------
  Principal: HTTP/satellite.example.com@EXAMPLE.COM
  Managed by: satellite.example.com
Copy to Clipboard Toggle word wrap

5.2.3. Using the IPA Authentication Setup Tool
Copiar enlace

Satellite contains a tool called spacewalk-setup-ipa-authentication, which configures your Satellite server to use IPA Authentication. The tool performs the following steps:
  • Configures Kerberos authentication on the Satellite server
  • Configures SSSD services on the Satellite server
  • Configures Satellite webservers to communicate with SSSD and observe PAM authentication
Run the command on the Satellite server to start the configuration: 
[root@satellite ~]# spacewalk-setup-ipa-authentication
Copy to Clipboard Toggle word wrap

5.2.4. Finalizing Authentication Configuration
Copiar enlace

Log in as the Satellite administration user and navigate to Admin Users External Authentication. Set the Default organization to the default organization for new users authenticating through IPA. Click Update to save this option.
Users can now login to Satellite using their IPA credentials.

5.2.5. Configuring IPA to Use Multiple Organizations (Optional)
Copiar enlace

The IPA server contains a parameter for the Organizational Unit for each user. Satellite can use this value to map to its own Organizations. This adds specific users to Organizations based upon the Organizational Unit value (ou) in the IPA server.
Log in as the Satellite administration user and navigate to Admin Users External Authentication. Enable the Use organization unit name passed from IPA option and click Update.
Satellite now adds users to Organizations based on each user's Organizational Unit in the IPA server. Users with no Organizational Unit are assigned to the default organization.

5.2.6. Configuring IPA to Use Groups (Optional)
Copiar enlace

The IPA server contains parameters for Groups, which Satellite can map to roles. This provides a method to use role-based permissions for IPA users.
Log in as the Satellite administration user and navigate to Admin Users External Authentication Group Role Mapping. Click the Create new external group link and enter the following details:
  • External Group Name - Enter the name of the group from the IPA server.
  • Administrative Roles and Roles - Select roles to assign to the group. For example, assign the Channel Administrator.
Click Create to complete the group creation.
Satellite now assigns permissions to users based on each user's IPA groups.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat